CVE-2026-40583

EUVD-2026-24179
UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.2 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 24%
Affected Products (NVD)
VendorProductVersion
ultradagultradag
0.1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/UltraDAGcom/core/commit/2f5a3a237ea519b48d71e6e3093c89f60694c7be
https://github.com/UltraDAGcom/core/commit/45bcf7064741897319b6196d3d9f9e1307093511
https://github.com/UltraDAGcom/core/security/advisories/GHSA-q8wx-2crx-c7pp
https://github.com/UltraDAGcom/core/security/advisories/GHSA-q8wx-2crx-c7pp